Weak certificate keys land eMudhra in hot water with global browsers

21 Oct 2026, 3:43 pm · 23h ago · 1 min read · YourStory

Digital identity firm eMudhra is facing global scrutiny after eight intermediate certificate authority keys generated for its international website-security operations were found to be dangerously weak. The flaw, unnoticed for 18 months since April 2025, raised concerns that attackers could issue fraudulent HTTPS certificates. As a precaution, browser operators have revoked trust from eMudhra’s emSign ECC Root CA - G3. India’s IT Ministry clarified that its domestic digital-signature business remains unaffected and separate from international operations, which undergo independent WebTrust audits. A government team is investigating the matter.